Check links at time of click with Safe Links in email, Teams and Office for all recipients

Description

Every recipient is covered by a Safe Links policy (the Standard or Strict preset, or a custom policy applied to all accepted domains) with the Standard values:

• email: Safe Links on (EnableSafeLinksForEmail $true), applied to messages sent inside the organization (EnableForInternalSenders $true), real-time scanning of suspicious links and links to files (ScanUrls $true), delivery after scanning (DeliverMessageAfterScan $true), URLs rewritten (DisableUrlRewrite $false);
• Teams (EnableSafeLinksForTeams $true) and Office apps (EnableSafeLinksForOffice $true);
• clicks tracked (TrackClicks $true) and no click-through to the original URL (AllowClickThrough $false);
• a short, reviewed Do not rewrite the following URLs list.

No mail flow rule skips Safe Links (rules that set the X-MS-Exchange-Organization-SkipSafeLinksProcessing header).

Rationale

Attackers send clean links and arm them after delivery, or point to file downloads. Time-of-click checks catch both, internal scanning catches phishing sent from a compromised internal account, and blocking click-through stops users from overriding the warning. Click tracking tells the SOC who clicked a link found to be malicious later.

Impact

Users see rewritten links in email. Messages with links can be delayed while URLs are scanned. Click data is kept for investigations; inform users and staff representatives as required.

Applies when

Requires: Microsoft Defender for Office 365 Plan 1

Audit

1. Sign in to the Microsoft Defender portal (https://security.microsoft.com) as at least a Security Reader.
2. Browse to Email & collaboration > Policies & rules > Threat policies > Safe Links and check that the Standard (or Strict) preset or a custom policy covers all recipients with the values above.
3. In Exchange Online PowerShell (read-only):

   Get-SafeLinksPolicy | Format-List Name, EnableSafeLinksForEmail, EnableForInternalSenders, ScanUrls, DeliverMessageAfterScan,
     DisableUrlRewrite, EnableSafeLinksForTeams, EnableSafeLinksForOffice, TrackClicks, AllowClickThrough, DoNotRewriteUrls
   Get-SafeLinksRule | Format-List Name, State, Priority, SentTo, SentToMemberOf, RecipientDomainIs, Except*
   Get-TransportRule | Where-Object { $_.SetHeaderName -like '*SkipSafeLinksProcessing*' } | Format-Table Name, State
   

4. Fail if some recipients are only covered by the Built-in protection preset or by a policy that misses one of the values above, or if a mail flow rule skips Safe Links.

Remediation

1. Prefer the preset: apply the Standard preset to all recipients (CB-M365-MAIL-019).
2. For a custom policy, in Safe Links, edit the policy (Security Administrator): URL & click protection settings with every option above selected, Let users click through to the original URL cleared, and users and domains set to all accepted domains.
3. PowerShell equivalent:

   Set-SafeLinksPolicy -Identity "<policy>" -EnableSafeLinksForEmail $true -EnableForInternalSenders $true -ScanUrls $true `
     -DeliverMessageAfterScan $true -DisableUrlRewrite $false -EnableSafeLinksForTeams $true -EnableSafeLinksForOffice $true `
     -TrackClicks $true -AllowClickThrough $false
   

4. Remove or rewrite the mail flow rules that skip Safe Links.

Rollback

Restore the previous values on the custom policy.

References

• Safe Links in Microsoft Defender for Office 365 Microsoft, vendor-doc, accessed 2026-10-24
• Set up Safe Links policies in Microsoft Defender for Office 365 Microsoft, vendor-doc, accessed 2026-10-24
• Recommended settings for EOP and Microsoft Defender for Office 365 security Microsoft, vendor-doc, accessed 2026-10-24
• CISA SCuBA Microsoft 365 security suite baseline CISA, standard, accessed 2026-10-24
• ORCA - Office 365 Recommended Configuration Analyzer (checks ORCA-105, 113, 156, 179, 226, 236, 237, 238, 189-2) Microsoft (community project), tool, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-MAIL-019 Apply the Standard preset security policy to all recipients

People and lifecycle